kainy's blog *Xbox360 Slim не се хаква! :)*

По всичко личи, че фирма е пуснат в обръщение. В момента усилията са насочени към изваждане на фирма от фирма и сменянето му с друг. Според определен деец това ще стане:

„If you post your LT fw, i can post back your dvdkey, don’t expect a freeLT immediatly, i just would like people to know that is not hack-proof at all. Seems they are going to scam reseller rather than idividuals.“

За сега общо взето имаме някакво инфо за демо фирм, предоставян от ban-guard.com. Ето направо цялото съобщение от Geremia по въпроса. Преди малко им пратих мейл, пък ще видя дали ще се сдобия с демо.

Don’t know where the demo i’ve comes from, but you could ask ban-guard.com or whatever for a free demo cause you want to buy 1000pieces for 45Kusd. If they think you are idiot enought, they send you an LT.bin with your dvdkey crypted inside.

Don’t know if it’s ban-proof, i don’t care, i’m just looking at the hack-proof side

Quote

The key is stored inside the encrypted firmware with yet another layer of encryption applied to it. So it is not possible to easily insert another key into the firmware, or to read out the key from the firmware. Without decrypting the firmware it is impossible to hack it.

Very true, but encryption (or better scrambling) is the one by Mediatek, it’s not your own.

Quote

code:0000AA96                 mov     R4, #0xF
code:0000AA98                 mov     R5, #0×49 ; ‘I’
code:0000AA9A                 mov     R7, #0
code:0000AA9C                 lcall   goto_read_dramR7R4R5_returntoR7
code:0000AA9F                 mov     DPTR, #0×8070
code:0000AAA2                 mov     A, R7
code:0000AAA3                 movx    @DPTR, A        ; all dvdkey bytes have been collected from 1Cxxx as usual
code:0000AAA4                 ljmp    decrypt_dvdkey_andcomeback ; let’s skip this crap with nops
code:0000AAA7 ; —————————————————————————
code:0000AAA7
code:0000AAA7 code_AAA7:                              ; CODE XREF:collect_dvdkey_fromSPI_toxtram_setC_setRAM6Cbit7_ifnotblank+4CCC
code:0000AAA7                 movx    A, @DPTR
code:0000AAA8                 cpl     A
code:0000AAA9                 jz      code_AAAE       ; checks if dvdkey all FF
code:0000AAAB                 ljmp    code_AB33

just skip the dvdkey decryption and you could use directly your clear dvdkey

Quote

We have also added further protection mechanisms to help protect it in the event that someone manages to decrypt it.

damn!! very true, does not work, let’s check

Quote

code:0000F686                 clr     A
code:0000F687                 mov     DPTR, #0xAAA4
code:0000F68A                 movc    A, @A+DPTR
code:0000F68B                 xrl     A, #2           ; check if code @0xAAA4 have ben altered
code:0000F68D                 jz      code_F691
code:0000F68F                 sjmp    code_F6A1

Don’t know if there are further antihack protections, looking for them, but cod6 plays fine and my secdata is still there.